Analysis
-
max time kernel
145s -
max time network
149s -
platform
windows7_x64 -
resource
win7-20240903-en -
resource tags
-
submitted
28-01-2025 06:07
General
-
Target
2025-01-28_d4b1f31f2f43c34c4da115f246b04d30_cobalt-strike_cobaltstrike_poet-rat.exe
-
Size
5.9MB
-
MD5
d4b1f31f2f43c34c4da115f246b04d30
-
SHA1
49989fa1d83131296ba0f04274a67483f866c445
-
SHA256
f34ec4e84d0d5277f5163cafeb4d0bf9c601a540bab2bba3eb70a29999444e7b
-
SHA512
05a2cf1f658f7a137641db2772645ade97216054223f0ff9d2afe56422b3170f8727edf69b24a5b31f95815685b9ee6981c957566a619a6b11a0d03d69a3c8db
-
SSDEEP
98304:demTLkNdfE0pZ3u56utgpPFotBER/mQ32lUL:E+b56utgpPF8u/7L
Malware Config
Extracted
cobaltstrike
0
http://ns7.softline.top:443/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books
http://ns8.softline.top:443/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books
http://ns9.softline.top:443/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books
-
access_type
512
-
beacon_type
256
-
create_remote_thread
768
-
crypto_scheme
256
-
host
ns7.softline.top,/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books,ns8.softline.top,/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books,ns9.softline.top,/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books
-
http_header1
AAAACgAAAAtBY2NlcHQ6ICovKgAAAAoAAAAUSG9zdDogd3d3LmFtYXpvbi5jb20AAAAHAAAAAAAAAAMAAAACAAAADnNlc3Npb24tdG9rZW49AAAAAgAAAAxza2luPW5vc2tpbjsAAAABAAAALGNzbS1oaXQ9cy0yNEtVMTFCQjgyUlpTWUdKM0JES3wxNDE5ODk5MDEyOTk2AAAABgAAAAZDb29raWUAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA==
-
http_header2
AAAACgAAAAtBY2NlcHQ6ICovKgAAAAoAAAAWQ29udGVudC1UeXBlOiB0ZXh0L3htbAAAAAoAAAAgWC1SZXF1ZXN0ZWQtV2l0aDogWE1MSHR0cFJlcXVlc3QAAAAKAAAAFEhvc3Q6IHd3dy5hbWF6b24uY29tAAAACQAAAApzej0xNjB4NjAwAAAACQAAABFvZT1vZT1JU08tODg1OS0xOwAAAAcAAAAAAAAABQAAAAJzbgAAAAkAAAAGcz0zNzE3AAAACQAAACJkY19yZWY9aHR0cCUzQSUyRiUyRnd3dy5hbWF6b24uY29tAAAABwAAAAEAAAADAAAABAAAAAAAAA==
-
http_method1
GET
-
http_method2
POST
-
maxdns
255
-
pipe_name
\\%s\pipe\msagent_%x
-
polling_time
5000
-
port_number
443
-
sc_process32
%windir%\syswow64\rundll32.exe
-
sc_process64
%windir%\sysnative\rundll32.exe
-
state_machine
MIGfMA0GCSqGSIb3DQEBAQUAA4GNADCBiQKBgQDI579oVVII0cYncGonU6vTWyFhqmq8w5QwvI8qsoWeV68Ngy+MjNPX2crcSVVWKQ3j09FII28KTmoE1XFVjEXF3WytRSlDe1OKfOAHX3XYkS9LcUAy0eRl2h4a73hrg1ir/rpisNT6hHtYaK3tmH8DgW/n1XfTfbWk1MZ7cXQHWQIDAQABAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA==
-
unknown1
4096
-
unknown2
AAAABAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA==
-
uri
/N4215/adj/amzn.us.sr.aps
-
user_agent
Mozilla/5.0 (Windows NT 6.1; WOW64; Trident/7.0; rv:11.0) like Gecko
-
watermark
0
Signatures
-
Cobalt Strike reflective loader 21 IoCs
Detects the reflective loader used by Cobalt Strike.
-
Cobaltstrike
Detected malicious payload which is part of Cobaltstrike.
-
Cobaltstrike family
-
Xmrig family
-
xmrig
XMRig is a high performance, open source, cross platform CPU/GPU miner.
-
XMRig Miner payload 58 IoCs
-
Executes dropped EXE 21 IoCs
-
Loads dropped DLL 21 IoCs
-
UPX packed file 55 IoCs
Detects executables packed with UPX/modified UPX open source packer.
-
Drops file in Windows directory 21 IoCs
-
Suspicious use of AdjustPrivilegeToken 2 IoCs
-
Suspicious use of WriteProcessMemory 63 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\2025-01-28_d4b1f31f2f43c34c4da115f246b04d30_cobalt-strike_cobaltstrike_poet-rat.exe"C:\Users\Admin\AppData\Local\Temp\2025-01-28_d4b1f31f2f43c34c4da115f246b04d30_cobalt-strike_cobaltstrike_poet-rat.exe"1⤵
- Loads dropped DLL
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\System\jQzTyHp.exeC:\Windows\System\jQzTyHp.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\dSKtubS.exeC:\Windows\System\dSKtubS.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\GPDLXTB.exeC:\Windows\System\GPDLXTB.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\UcmSIMI.exeC:\Windows\System\UcmSIMI.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\jBXxAle.exeC:\Windows\System\jBXxAle.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\nPJDCuT.exeC:\Windows\System\nPJDCuT.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\FdQRrLA.exeC:\Windows\System\FdQRrLA.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\EfLFKmM.exeC:\Windows\System\EfLFKmM.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\DQEdPHF.exeC:\Windows\System\DQEdPHF.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\JaYHisd.exeC:\Windows\System\JaYHisd.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\dRSTumL.exeC:\Windows\System\dRSTumL.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\zHBgPNz.exeC:\Windows\System\zHBgPNz.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\JRNnPrR.exeC:\Windows\System\JRNnPrR.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\SgbkXDY.exeC:\Windows\System\SgbkXDY.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\nuYeUSV.exeC:\Windows\System\nuYeUSV.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\mZdwVZD.exeC:\Windows\System\mZdwVZD.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\MktqWdn.exeC:\Windows\System\MktqWdn.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\fnOEeXS.exeC:\Windows\System\fnOEeXS.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\qHmGqRO.exeC:\Windows\System\qHmGqRO.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\ssWtGGa.exeC:\Windows\System\ssWtGGa.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\NtSSYPA.exeC:\Windows\System\NtSSYPA.exe2⤵
- Executes dropped EXE
-
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
5.9MB
MD5f218173c8f519cf0eb7048a54f7eef4e
SHA10ea9a315359429e2851e2f9262686bb79779df69
SHA25634aeec59dbe8968364775db6ec399e038de1bcb8ebe4db24106e1477308bd63a
SHA512b4d5c67132bdd8a584dadb5a54a930e86f7873264c689150d070617537621faa95a81dcb50a5bec1f152a6e9be53f69be815860ac79ce7894fc008d5d948eac4
-
Filesize
5.9MB
MD55e20da4500d3283f364465f4816c446d
SHA1a5db58e1fc320c02abfb9977393db1115a0880df
SHA256ab95daa8a377305d2c2bf2643adce151c0b0049e23d7a81962b29cca33a34dfc
SHA5126886e6328dbaae18cd7c1df4fc2f3bbea6b49f3cc959c084f89a26dc3cef190d6942f08d7c4bde2884eb442df733da8d5a253975df05410728fe57b13e1bff20
-
Filesize
5.9MB
MD52b5bcc656b275b75cbacf43d4ff6db6b
SHA1f753bcbb01f3615f17095375c5f0a16609cef87f
SHA256d67cbb9f6fa90e3e9c8aea0e4d3fe60e8b2e989e3102d57182bb8eabf249b61d
SHA51268f13271ba0323ef058447145bdadf78f77a3d34d8859a73097986ed96ee0cc3acfc32e48372188c63fa29ddeef4b35125d9dd02ea134816ee2ddf63e6fef474
-
Filesize
5.9MB
MD5f77b12f02fb2da1aee31fa0b43432158
SHA1835d147d4c96311b53b8868731fd929d4d2f62af
SHA256ac25042829a439ee2dd24c0016e50127b671a7fdc6ff44d4a92a92701cf6f259
SHA512ed0e4f92fa0a783510379e2c7a7d5049900ac31dbdfb3c933b70ff04f8a192d4d2ca3928c246c669c17fb7d0a7e2c3909b56b43c34d4a76c63a1169869aff17b
-
Filesize
5.9MB
MD5c0e3df9fe04669814a378987d1c0bb20
SHA1d848575bb8dad9afcbb818a7667a1987b6bf1cfc
SHA256911f7e42c2e97584f99f33b4751fc003a35b3ade8c9b77fc2d6a43582110c068
SHA512ec3ec67723abcddf91ed7972566ad2fe01eeb17a5aed9191d5203450b39191cf807dfe4e2fd4df7cc0193343048b73d932c74730dbdd84955d2e2d67e3070c9d
-
Filesize
5.9MB
MD5bec77a50a579f53e3a02b0b9e11cba64
SHA1c2a9c736b02cb1e35d7ecb3b39b72d1ff0e8fc67
SHA2569916e01428e99b0b0b587bebf27737eadfb647b2835ea9a40df5c614c55ecc9c
SHA512f10ecccefb4e19c098d8ff537620fa9cfa92b5700af6f4e332c6a90d666a1504be9e08cb5ab234365803db9a141886ef3b2fe27f3dae74951cb2ecd638f1e00e
-
Filesize
5.9MB
MD58066bf75d0598fb0ff10fcc4e1c148b8
SHA1e6ed8c7ef6a732a88be92ce7ee1866f82478c0b4
SHA256abd2da607b5f33cb7a069f16516da8ab67f4961c0bdb6003acd7871d875edbf9
SHA512b0165c769f2997eb928a762b462e369c225e5acf40ea6e1eac1e6f6cfeb05bf4a6d3e764efdea9eeae655f18c9ea75f0f5243a90789a7dd5bfb5eb92fe0b6be9
-
Filesize
5.9MB
MD59a43fea95d81271c9b06b988169b4173
SHA17a0e504924156c0bbc304487a4ab47a8efebe20b
SHA256b854f5e10b81b1d270616b4a73dad2f4489e29eebcbe5106f43ee5eed4d951f6
SHA512e3dcf6fccaed18d1c66da0cfecdd08ef3242e5892e1c84d6f79b0507d5d50232a5c435ea31e06163593b580257149f0d378a1dd6eaf1c769456e75ac3d89d666
-
Filesize
5.9MB
MD5e59217af75d85855c11a79790980bdc3
SHA1d6eb9ceaa327aa05cd50cdde64e0366f0c3b981e
SHA2563bb38cd170a815a50afd41ef199246a2d727984a548946ce751571b365193464
SHA5125be4861d79c86417422e36e4191e1295eb71d2d97a5e525d5aa4ed8cd1d064a06142d080c9a50077d1780b91069ebcf5369bae148bf4b0fa263f0927706fc661
-
Filesize
5.9MB
MD5d7c748b0611dcbc5c351b4b93db6d212
SHA1372cae9c32a66ecde10cd31f84fdde87a8f1c3d7
SHA256618f1492d18c2d1698d0b4f3d103bab2b7873aafe36ef82a54d7bb8e8f61fc1f
SHA5120b8dbc3d9631775817d8a4a45526c9bc62bd75bedeba858704298ea2e47889b801e26b3df69d7dabfe221de10bb3bdfd7cf6bf5a2cb316e0d78d3ddff585a629
-
Filesize
5.9MB
MD5f351b5c648dfa3827174ab2977505c82
SHA19e6809811d1b2073ba99346cb0656165f423074a
SHA256ce854e2cbdc4d756f0ee6970013b4ebdf878b411ce790c7ad9774ecca64d8370
SHA5126a33e8562df9d8032802f5486659cae54bb5d6a6dc12285af170509ec3c780487d719be4f2c40306b1b31f767d37a208d09a131e4f87be51421d751176a6b0e2
-
Filesize
5.9MB
MD5fe072daa04c9758d3427326730e7a15d
SHA1f7825bd3b4548d81f9b0beba43eba5fe13b081ce
SHA256fc093156beceecb982f14b4c3b29695ad4ea179ee1649da27942dd677d9a46e3
SHA51249c5270c402e4fd3a4cd9902d48457e6d257e3b4405b0826ebb854bf5324de4d193b2dae0ad544bbc1693bd71bb3283e1a49e2c2c51a65294f0530567ac6e24e
-
Filesize
5.9MB
MD5f00380f755df93a01b219a0dae16747c
SHA1b338d091b71165df845efe72ffd3b1febd486786
SHA2561700e6b937e920da3c8c914ca4fc3cc3b20ebc7112f0a5a82304d020e6326c32
SHA5121369a79bdbdcd9a76df36e125bca823552e25c05588b7f7af1c77a7b6eae962be758c28923554d0291eaf655f14d08f9b919d0fdc74a0be08320b35d54c58ffa
-
Filesize
5.9MB
MD52d95fc346367a3269702dd4cb1949d16
SHA1c89f809dad09a5ab1d629c002ec1e3adea181cad
SHA256cd1ac38500c3de94bbf1a33be22964998d980cf4d8fd6b60e2c9006836f7a4e6
SHA512f795839904ccba36d10bd1612d91bf4f514cc437aafbad0b2fc95a2560c1da1522965b607a8c62af681004e81d45939a89f863478e8912747cd4dd7bd3bf6e45
-
Filesize
5.9MB
MD5e7146188805b8811c4038e801e1c2c22
SHA1f770edc30815a97344f83ca3ebcc6b822f8bb12b
SHA256f437cce59e5db0c7b13fed726fda49fca14b2dcbbc47d68e394b62246376fb84
SHA5120a5df1510c3ee65c458324db5f1406ffd330384804f09f51f5b6d56bdeac6c513d43e09b0f11e1b50511bfa4a5d593e4559823c55ad7963e8da9ddc54470d8ee
-
Filesize
5.9MB
MD59633222b4e9d2e8fa29f49982caca292
SHA167636cd7571eae64d82350fabaf0e8f28542f275
SHA256ee90d26e66677d4cc152e2968fe6147a57662c454b535268c4adc7d1fc87c5bb
SHA5121a4194e74d6e07d2d811eeff55763396f8dbcedd6cb5333895bae996dd1ab7815e66ec490a20ea5e5eefcce1fe3eff03b425770a2fdd659ff023956e6b995cd4
-
Filesize
5.9MB
MD569c6ccd9ed0e13d2024695d160df1146
SHA1dd97372cd6bfb1991db986c94713503a656386ba
SHA256f6f7e2de5bc6221571e3e308a268eef0ad7601a5b15ca1ade809b3d53e05f853
SHA512491107e1c35564c946f0126c6981402a056fd7783e674c099123c0c2f065ffa9009bf3c32d451549f69378f3a48da1c717327b13e58c5f1159c920abf5b9802b
-
Filesize
5.9MB
MD573a400021b06abe72ed4782762d5a665
SHA15414eadb21ffc8f0ed747d690a9e5d38e1f208bb
SHA25604ef22d3fafc0c851a41637a3357bffb58418e0a6fe779f653748b7cafafcbb0
SHA512a414bb50d90a67c297571ec2d83d4aa1f922dc4462248fd99131fd0d10645a77803e2af11129efae34ab3bd87069f731f22ecf2df5aaa259a4712b38019b1621
-
Filesize
5.9MB
MD539a6002d0ca3a279d41ed95dbdbc08f2
SHA13f48cf44edc5822609b66cbb00b6f0b8a0271f55
SHA25616b929d4fac4dcedaf0a0cbeb4d61ccbf8413e93bbd81655284afc122f8b884c
SHA5129086c1a8aae83a3b0ede90589c50089f1c434c68235b96a1c25880a248c4adf373de7d733c25e928a176f5babf219770e8034b0990d02195bc374a65eca04077
-
Filesize
5.9MB
MD5103c72e7a11188b9d26aa85497c91395
SHA1cd40b4a0af4f8739b5e6b057a584eecfb91d4bdc
SHA256b14122190121355324eb371d415384913250f4ffc03c6d68ca0366b04162de48
SHA512bbd954c7af1e0b942ef101fc14f15d9ea8209a0b2aeb778c24e59218334f8853c50130e57d5ae019d52691285375e533baf05023eb1c7a6e0b4cb73b416cf169
-
Filesize
5.9MB
MD59e50782b9a8fae12243bccc491626d2f
SHA10b16ce1784d20103e83ad9570ea726e7e63f2d18
SHA256ac90dc89790cfe0052bbaaa82d248b6e9ac390ed7711ac55eb78efe9e19a9c56
SHA512b3882d19072ebff5deeaf41b228e00093b6ebd3e9f6538514f13687ff43b6f1c830065281655b046f2c3d9e4951b96edca110c6c31dcfcc81abc2299c83ac985
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
64KB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB